ermac | 33b7572766cef039979714d229ff2076cd5c979e22a11891ef6fc4baaac0e0fc

Resubmissions

07-08-2023 04:30

230807-e5bttaeh2w 10

04-08-2023 13:49

230804-q4wy5sbb43 10

08-03-2023 22:25

230308-2ca35sgd5w 10

Analysis

max time kernel
3234902s
max time network
43s
platform
android_x86
resource
android-x86-arm-20230621-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20230621-enlocale:en-usos:android-9-x86system
submitted
04-08-2023 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sakinacmaermacapk.apk
Size

2.9MB
MD5

59c1dfcf5cc3b76c961fe08f163dbb02
SHA1

12d002783acc1fe8573abf8f07e7fc79d2769f27
SHA256

33b7572766cef039979714d229ff2076cd5c979e22a11891ef6fc4baaac0e0fc
SHA512

38639d0029410c6af04c15e53a37d4c7e8e572cf8fae4c97ee347885615c30d65825d85f7c71149d6bc9bee8db5c12048695cf59b91f1e6241568d69384b0184
SSDEEP

49152:Fun4FKKpN0DAb3KBoNEzcnxmnHy99J9N1OG8Ps9KL4fED3AfnkIPBNLEO4ZT5Noq:FCelAAnxc49D/B5qD3AfBLn4ZTcyN

Score

10^/10

ermac banker evasion infostealer ransomware trojan

Malware Config

Extracted

Family

ermac

http://31.41.244.187:3434

AES_key

Signatures

Ermac
An Android banking trojan first seen in July 2021.
banker trojan infostealer ermac

Ermac2 payload 2 IoCs

resource	yara_rule
behavioral3/memory/4162-0.dex	family_ermac2
behavioral3/memory/4094-0.dex	family_ermac2

Makes use of the framework's Accessibility service. 3 IoCs

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	com.zixudahitifo.gicu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId	com.zixudahitifo.gicu
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText	com.zixudahitifo.gicu

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps). 1 IoCs

banker

description	ioc	Process
Framework service call	android.content.pm.IPackageManager.getInstalledApplications	com.zixudahitifo.gicu

Acquires the wake lock. 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.zixudahitifo.gicu

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json	4162	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/oat/x86/Hl.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json	4094	com.zixudahitifo.gicu

Reads information about phone network operator.

Removes a system notification. 1 IoCs

evasion

description	ioc	Process
Framework service call	android.app.INotificationManager.cancelNotificationWithTag	com.zixudahitifo.gicu

Uses Crypto APIs (Might try to encrypt user data). 1 IoCs

ransomware

description	ioc	Process
Framework API call	javax.crypto.Cipher.doFinal	com.zixudahitifo.gicu

com.zixudahitifo.gicu
1⤵
- Makes use of the framework's Accessibility service.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).
- Acquires the wake lock.
- Loads dropped Dex/Jar
- Removes a system notification.
- Uses Crypto APIs (Might try to encrypt user data).
PID:4094
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/oat/x86/Hl.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4162

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json

Filesize
444KB

MD5
0bea6585938f017bcc65885ca587fbb0

SHA1
ca739eb958306424008b9980c18e7a07aef55391

SHA256
6fc4576bc81f3beda1a9e1b832886189f572ee444e0c5c9b4e450bf72fd50b7b

SHA512
7c8f576ff28090382b234be8b58d800c2f903c31d61c1a7c2366620d93c976c7050fcc7a65bc70032df6f56b4e2c086ce44b009f57a9686ea4ad9d09f42c45f5

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json

Filesize
911KB

MD5
2a7621a9ef6e7e4087b5e3d81d96538f

SHA1
1313742895ba84ecb5cfcf74709b31ecd6b729ab

SHA256
36dba42f29f9cb4284a67182928a5ac19087954fc750c2af6670cbecfa26c456

SHA512
3e5da188d2627a9f7140e7e5359314f0a442db6032f22daec6ec361479a361ad081123459731ffbcdcc7c9651646da0f7bf7b1230b81ec2bd645519f19e90589

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_DynamicOptDex/Hl.json

Filesize
911KB

MD5
e071d783d184c999ca79e2774e4147a7

SHA1
f4e37f05941ee25e02bc6781ba5ddc32d6eb9d7e

SHA256
123eb705335efa5af8a5b85f34e5a3afb45db0a406cf2cbbe15c9a202819d5d2

SHA512
e91e29888b9bf58835b458fb3cab0b300b9ca7c95a07282dfc7d7a75b6e67c07b26a2fd976b8d7d04b010881bf1537eff22ce7cde20c0abebc76550137b1f626

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Cookies

Filesize
64KB

MD5
cb7543c4df600f2af58097cce0e334ba

SHA1
83cc92f38c27fdb4fa519b1ce2f37912f24af1f0

SHA256
64c022ae708f94ffde986e105d88f708884de325720bfb9925c4160a6d417233

SHA512
ad51cad0472327bd68aa2d791341cfafed58971752352537bb603ed18b15a3f9185e9150983a28ecd09606e8dcaef6d1c9d93213dd246ef7720f39842eb3d980

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Cookies-journal

Filesize
1KB

MD5
0afce7a520ee9de432bf9381f457b7c4

SHA1
ed63f3d8c3ec0c3b6c5d507484b7f1679ad07943

SHA256
ef866b70800515e30db35f0aeb8cf0ed73a60de242fd95803b263d800a972797

SHA512
cda0012cd10f472e6a97d4e11d7cb03613933a7c0cb18927874d4f63e0f58c83495d573d43656a1b99f445b78496f04b26d7a362ebcd6ff275bf2fdd3fd5ae14

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/GPUCache/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
3fd2f6d505483ffe678fa3dbfcd058b1

SHA1
e701e1a8ad197daba3c5ac2752b924d959605937

SHA256
0daed39c9a571dbc32745d6307cebd0b4903bf4a892d78b03e8955fac95bcf61

SHA512
6900b243462b5479ed5ef294babae4f6e5249929e6d44825c15e58e87e43c978359db67dbea0ed8beff916215720a463be37b0793e269d08e9b07819f54c8619

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/GPUCache/index-dir/temp-index

Filesize
48B

MD5
b649b1ceb0cb6bde2dca86b741aa5369

SHA1
50d838d2ea79a21a701c739abd3317a026a88f3e

SHA256
2f85855014ac42e56b654bc70c7d0ff25ea490301389f5d6e344ca1cbb59d479

SHA512
783022a76b77f5f410b5ab6ee1e6e51d9b37e99a20268b7fea4789fadac7c357beb2d01e38049041aea904e2f8538f9a6daca37aa60d193f4204c828b268c453

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Web Data

Filesize
104KB

MD5
dc79f9ce5f3ab5270b33e61119dfc959

SHA1
1844bf222a5144b513dcf2fb50a18c011701c647

SHA256
47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65

SHA512
18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/Web Data-journal

Filesize
1KB

MD5
092a653b929068bca2e5be0e9809ec1b

SHA1
344ab7eb4d5d643e8f3a1accc6d85a786a86016d

SHA256
ed9ef1c26837926f5ef4f08bd865e9d5639012cd1cf3b54189ae5486de7a7098

SHA512
bb3bf2291d3b845cce3281539e4f73605dc6f0abfa78c33324cf9041b8918310232d83ce0ed687fc0502234db10e032ded76c7975f85815c0e776e171ea389e9

Download Submit
/data/user/0/com.zixudahitifo.gicu/app_webview/metrics_guid

Filesize
36B

MD5
6921c758b81a17e01952f70c1ea0a3b4

SHA1
71b21f01d6ca982275947b21ad4e4527209dd21a

SHA256
181727e125d4144f1c3b2a7025ad199a5b7c0a58be4083ddef6e0bfb225e3b10

SHA512
9f3f4f65ebcb0dbc84fccb80a388bda92a4876d055a0d88ea5d66b7281f61986d8f8bde34148f4df128ed5a33cebea998382a0ae01ee517ba9d91d6355e1050c

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/1dc40779bb8387b8_0

Filesize
201B

MD5
f95136ce26d419ae7a30de217850130b

SHA1
8520c1b771e600b3ae5794c7dfa55fc6873fc7bb

SHA256
81d6e10447f9a529b76ae81719950eafe12dfceaf6269311bac352284c671751

SHA512
248a2656fb2fe5153e8600e149dfe804d5f631f5dd67dc64de207711a376458504e11012e90faeea508d9fc0ca2d040ffd96667c6a47ade7cfbd01be138cdd4c

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/1dc40779bb8387b8_0

Filesize
201B

MD5
f95136ce26d419ae7a30de217850130b

SHA1
8520c1b771e600b3ae5794c7dfa55fc6873fc7bb

SHA256
81d6e10447f9a529b76ae81719950eafe12dfceaf6269311bac352284c671751

SHA512
248a2656fb2fe5153e8600e149dfe804d5f631f5dd67dc64de207711a376458504e11012e90faeea508d9fc0ca2d040ffd96667c6a47ade7cfbd01be138cdd4c

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/4c70d54a92cdffb7_0

Filesize
245B

MD5
bec9d05c0fecb3a7c9caa49e2efad9a7

SHA1
34642fc40b73dc8b38bca349779de324f8c74d47

SHA256
c712d4b90bd5f41f2819b432e3f5eaf8ef6175d033a9573bf31639aaa859cc26

SHA512
b062935455762f5e9b8862c5ed2f489360eab5ea370d059eca24c319f7cc4a248256b6fd11edee8503bd917ba50f8531b44bf787378a2db197c5a5f7a6954228

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/4c70d54a92cdffb7_0

Filesize
245B

MD5
bec9d05c0fecb3a7c9caa49e2efad9a7

SHA1
34642fc40b73dc8b38bca349779de324f8c74d47

SHA256
c712d4b90bd5f41f2819b432e3f5eaf8ef6175d033a9573bf31639aaa859cc26

SHA512
b062935455762f5e9b8862c5ed2f489360eab5ea370d059eca24c319f7cc4a248256b6fd11edee8503bd917ba50f8531b44bf787378a2db197c5a5f7a6954228

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/74a997b66d0f8136_0

Filesize
234B

MD5
0d915675fb63f2db8deb0ac9383304a2

SHA1
70ca56529803339dea97ed0dc7dc50188c84dc74

SHA256
cd08dc759c78debda56752cc01f9f18a6564b3775591d436d9b292f440792666

SHA512
073d44aac30ce59132bfaf39a529ac1c31c7f8aa3562364f237a5c2816657bc75a75301c72cd6bb2d3d56fd442c2729dcaba695511dd31eb478076858ad0d2dc

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/74a997b66d0f8136_0

Filesize
234B

MD5
0d915675fb63f2db8deb0ac9383304a2

SHA1
70ca56529803339dea97ed0dc7dc50188c84dc74

SHA256
cd08dc759c78debda56752cc01f9f18a6564b3775591d436d9b292f440792666

SHA512
073d44aac30ce59132bfaf39a529ac1c31c7f8aa3562364f237a5c2816657bc75a75301c72cd6bb2d3d56fd442c2729dcaba695511dd31eb478076858ad0d2dc

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/a63f6ad0ba0d5e6b_0

Filesize
30KB

MD5
05fb2fc8597ddb826567adfcb102e6e0

SHA1
d6299bc8fbaec6ea8c862a4f86233ad3d0162a26

SHA256
c6f338444199d08207b27687472e1579d4a6ba94886b3a0c64146d32ed55dff9

SHA512
6922dc7a9e2446b71bd63e2976a7a1a3e9e5dd28a4b30e3b94e27d7dce8ec54dd78ab827be048f3cb7ffbefd19970db112acc4bc61857f4429b4f65ca84b96cd

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/c4c671fa17cf644a_0

Filesize
224B

MD5
4cd3fdf1031a371edad1c7f2e329d41b

SHA1
283472077c22d64f23037e963ee5fe933865ab46

SHA256
6bda71f033769bbca3cf116c2b1d303e124584675aa5bf710bf8b1b123e27b07

SHA512
bf73a18509ff58f21ae281566f745de39b2eedbf7496b8bfce3938a6f7be91453d71be7b5abb14a49ca0fa1e74a035ed26f9e2e724ef260ae4182d782454f3f2

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/c4c671fa17cf644a_0

Filesize
224B

MD5
4cd3fdf1031a371edad1c7f2e329d41b

SHA1
283472077c22d64f23037e963ee5fe933865ab46

SHA256
6bda71f033769bbca3cf116c2b1d303e124584675aa5bf710bf8b1b123e27b07

SHA512
bf73a18509ff58f21ae281566f745de39b2eedbf7496b8bfce3938a6f7be91453d71be7b5abb14a49ca0fa1e74a035ed26f9e2e724ef260ae4182d782454f3f2

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index

Filesize
20B

MD5
93027d42b314432c4216e6cfca48b384

SHA1
43448dd8102979c3926828182579691945eedd4e

SHA256
3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c

SHA512
a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
48B

MD5
6f141890282e9b350ce9bd3d010d5aee

SHA1
84155ca2d6be1e2f1931545d9e4700bd5ddf5460

SHA256
86df4bcdcdb8c089127d88fbc068773b8604383f1b0a9c975ea8ed27cf4e25ba

SHA512
b81adb48d10bf632a4718121d17addc8ee19c0f6662cdf7ab7120368acffba249fad2bfe57dd21cb27d4ae13d018660c1e24d8c5ef834fc8a1de4d5b5612f39b

Download Submit
/data/user/0/com.zixudahitifo.gicu/cache/org.chromium.android_webview/index-dir/temp-index

Filesize
72B

MD5
9057984954d313b559c5e6b533c5c506

SHA1
8ff316406bb0123d4a418e4e15a1d335891617a0

SHA256
4057c2e744c14279088e9895b190042b8d7d4620170188aca271264ceaba1a8d

SHA512
19869e2633034db012ea18a67f2e4c5b100427d132b0450260952f33c9b6706959b574e4db787fd302f2a7523e04fc743c94bc1cc632545913663a33ea809208

Download Submit
/data/user/0/com.zixudahitifo.gicu/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit
/data/user/0/com.zixudahitifo.gicu/shared_prefs/settings.xml

Filesize
134B

MD5
f770197dee8ab5ace13f325d8f7999fd

SHA1
c199cc8f2bc121a6ddb8d2b61922ed4c3797995b

SHA256
a98f1264aab26b21d005fecbb0db2e746bd2b24ae04c3dbae162f6436206e3cc

SHA512
de3ab342f0b02ab96e97bfc25a73dd250f4d699517b78b5a89d62ea2c136598046173f4b49ca3060b05b077420e26682eb0f1bbd2d1855f06331cb9180920897

Download Submit